What changed in the driver signature requirements for Windows 8?

Question

I've got a passthrough NDIS intermediate driver, consisting of two .inf files (one standard and one miniport) and a .sys file. Because of the Windows 7 driver signing requirements, I had to get a code-signing certificate and sign the .sys file in order for the driver to install on a 64-bit system. This works fine, and I have many successful Windows 7 installs.

However, the same installer fails on the Windows 8 Consumer Preview (64-bit). If I boot with Windows Signature Enforcement turned off, it installs correctly, so it's definitely a signature issue. What new requirements were added between Windows 7 & Windows 8 that I need to follow in order to get my driver to install?

Answer 1

Regenerate your cat file(s) so that they comply with the signing requirements for the new Window OS.

For example, in my build script I had to add 8_X86,8_X64 to my inf2cat command:

inf2cat /driver:"%CD%" /os:XP_X86,XP_X64,Vista_X86,Vista_X64,7_X86,7_X64,8_X86,8_X64

---

For Windows 8.1, you will need the inf2cat included in Windows Driver Kit (WDK) 8.1 and depending on your target(s) add 6_3_X64, 6_3_X86, or 6_3_ARM to the /os:WindowsVersionList.

Reference, Inf2Cat

Answer 2

I had the same problem. I use makecat to generate the .cat file and I never included the "<HASH>" at the beginning of the .cdf file lines that list the filenames. That worked with Windows 7, but no longer with Windows 8.

See the makecat website here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa386967%28v=vs.85%29.aspx?ppud=4

I had a .cdf file like this:

[CatalogHeader]
Name=xxx.cat
[CatalogFiles]
xxx.sys=xxx.sys

This worked with Windows 7, but not with Windows 8.

The following works with Windows 8 as well, plus it gives a nicer dialog when installing, even under Windows 7:

[CatalogHeader]
Name=xxx.cat
[CatalogFiles]
<hash>xxx.sys=xxx.sys

To make it clear, you have to add the text "<hash>" (sans quotes). That is not a placeholder for anything, but really the literal text. makecat will later replace it with the hash of the file in the .cat file.

To make it even clearer, "xxx" has to be be replaced with the proper names of your .cat file and driver, of course. :)